Skip to main content
MI Support IT logo

IT security

What is symmetric encryption?

Symmetric encryption uses the same key to encrypt and decrypt. See why AES protects almost all your data, and where the pitfall lies.

In short

Symmetric encryption is encryption where the same secret key is used both to lock and unlock data.

The method is fast and strong, which is why symmetric encryption in practice protects the vast majority of the world's data: encrypted hard drives and phones, databases, backups and the actual content of all secure internet traffic. The standard is called AES, which with 256-bit keys is considered secure for many decades to come, including against quantum computers.

The method's Achilles heel is key distribution: both parties must know the same secret key, and how do you share it securely with someone you have never met? That is why symmetric encryption is almost always combined with asymmetric encryption, where a key pair is used to securely exchange the symmetric key, which then encrypts the data itself.

MI Support IT helps Danish businesses with encryption in practice, from encrypted devices and backups to key and certificate management.

Back to the glossary

What is symmetric encryption?

Symmetric encryption is the classic form of encryption: the same key is used to turn readable plaintext into unreadable ciphertext, and to unlock it again. If you know the key, you can read everything; if you do not, the data is worthless.

Because only one key is involved in the computation, symmetric encryption is fast: so fast that modern processors can encrypt and decrypt data in real time without anyone noticing. That is why symmetric encryption protects the actual content almost everywhere: disk encryption (BitLocker/FileVault), databases, backup and the content of TLS connections.

AES: the standard protecting your data

The dominant algorithm is AES (Advanced Encryption Standard), which NIST standardised in 2001 after an open international competition. AES works with keys of 128, 192 or 256 bits, and AES-256 is today the de facto standard for protecting sensitive data. There are no known practical attacks against correctly implemented AES, and unlike RSA and elliptic curves, AES-256 is also considered secure against future quantum computers. For streaming purposes the algorithm ChaCha20 is also used, for example on mobile devices.

The Achilles heel: key distribution

The strength is the simplicity. The weakness is the logistics. Both parties must know the same secret key, and it obviously cannot just be sent in an email. The problem grows with the number of parties: where one key pair covers many counterparts in asymmetric encryption, symmetric encryption in principle requires a unique key per relationship.

The solution in practice is hybrid encryption: asymmetric encryption (or a key exchange algorithm such as Diffie-Hellman) is used to securely agree on a symmetric session key, after which AES takes over and encrypts the data itself. That is exactly what happens in the TLS handshake every time you open a secure website.

What does it mean for your business?

You rarely need to choose algorithms yourself, but you do need to ensure encryption is actually switched on and managed: full disk encryption on all laptops (enforced centrally via, for example, Intune), encrypted backups, encrypted databases holding sensitive personal data, and control over where the encryption keys are stored. A stolen laptop without disk encryption is a data breach with a duty to notify; with encryption it is typically just a loss of hardware.

How MI Support IT can help

We make sure encryption is switched on and documented wherever your data lives: devices, servers, backup and cloud, and that keys and certificates are managed professionally via PKI management and HSM. It is all part of our work with IT security. Contact us if you want a concrete overview of where your data is genuinely protected.

Shall we talk about your business and your needs?

Real people talking to real people. We get back to you the same day.

Write to usBook a meeting